analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

UnityBase.DocNet dexInDocSetConsiderationStaffUnitID.msg

Full analysis: https://app.any.run/tasks/e5c734e7-6b62-487b-8d3f-690325e41597
Verdict: Malicious activity
Analysis date: May 20, 2022, 16:24:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

07098E9B210C568457236994DEC1C211

SHA1:

8BC5FF2C4718144025C234F6971E122CBF6B8DAF

SHA256:

A380B30383CDCD83359CC9BE841919A9A3FD5B9B2AF26767FDCF9301B86EFDD1

SSDEEP:

1536:wGeibcW5WCW1biWg9WQWpJTdTHAYJXm83Jv:w3ibO5TdTHAEz3Jv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2812)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • OUTLOOK.EXE (PID: 2812)

    • Starts Internet Explorer

      • rundll32.exe (PID: 2120)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3760)

  • INFO

    • Reads the computer name

      • OUTLOOK.EXE (PID: 2812)
      • rundll32.exe (PID: 2120)
      • iexplore.exe (PID: 1128)
      • iexplore.exe (PID: 3760)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 2812)
      • rundll32.exe (PID: 2120)
      • iexplore.exe (PID: 1128)
      • iexplore.exe (PID: 3760)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2812)
      • iexplore.exe (PID: 3760)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 2812)

    • Application launched itself

      • iexplore.exe (PID: 1128)

    • Changes internet zones settings

      • iexplore.exe (PID: 1128)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1128)
      • iexplore.exe (PID: 3760)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3760)
      • iexplore.exe (PID: 1128)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3760)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe rundll32.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2812"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\UnityBase.DocNet dexInDocSetConsiderationStaffUnitID.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2120"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL docnet:http://docnet.kyivstar.ua#cmdType=showForm&entity=dex_indoc&instanceID=3000940599868C:\Windows\system32\rundll32.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1128"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=57426&Ext=ua#cmdType=showForm&entity=dex_indoc&instanceID=3000940599868C:\Program Files\Internet Explorer\iexplore.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\rpcrt4.dll
3760"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
18 655
Read events
17 949
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
150
Unknown types
4

Dropped files

PID
Process
Filename
Type
2812OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR9193.tmp.cvr —
MD5:—
SHA256:—
2812OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2812OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:B61F0F32AFB34F3FB554DAFB77034B0C
SHA256:9E1E219EB8521624867C0AA3AC1341E86E3E9F6723EB86D9C49DEE7F1E26FC22
1128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:AC8FE9D561E9E7288AECF13F03AEA3D1
SHA256:CECD911136F3CCBE6F4869CBCBD9FD15B3FA91CD2FD49B9655FA3BCF8E932C05
2812OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:9D4A4F225883B766FF9A87374AAF5C51
SHA256:D264BD563556A0DC5F032C2412D6B4CEBD6079E04CF66B2FE0B1E139FE76C167
3760iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\FXJE835V.txttext
MD5:E6666AF37D89C6F5315366721A6469F5
SHA256:A45B470D40B37618ADAB985492CE4F72ABF29C33A26D14193736387F76DE5415
1128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:04A27F5C4FC87FB2638EBD932220A56E
SHA256:D485A1EA836C4C431D173BC0A633D3E0297807B49BCCCEC608583B7997FC25C3
3760iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\BDBZJ5YS.txttext
MD5:46A93010F36ADA4803947D930E2F12A8
SHA256:62A1E404B8E274BFCE24E12E9340A24656E33179F9E6C5740165AE878F5AEA11
3760iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HZDWGOVR.txttext
MD5:5D9B95643B6747F0BAC71C5093420ED0
SHA256:A96E392CD2F827E6BF9E13AE462A0F523AA6A0CD2540E125BBC0FDFCA3E974C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
31
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3760
iexplore.exe
GET
301
23.216.77.204:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=ua
US
—
—
whitelisted
1128
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1128
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1128
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b44c42afe2c7b47a
US
compressed
4.70 Kb
whitelisted
1128
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?653e14a32b4cf1f4
US
compressed
4.70 Kb
whitelisted
3760
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
3760
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ec8d1309134e3071
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1128
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1128
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3760
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2812
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
1128
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3760
iexplore.exe
23.216.77.204:80
shell.windows.com
NTT DOCOMO, INC.
US
suspicious
3760
iexplore.exe
104.89.38.104:443
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious
—
—
40.126.32.134:443
login.microsoftonline.com
Microsoft Corporation
US
whitelisted
3760
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3760
iexplore.exe
40.126.32.134:443
login.microsoftonline.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
go.microsoft.com
  • 104.89.38.104
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
shell.windows.com
  • 23.216.77.204
  • 23.216.77.199
whitelisted
login.microsoftonline.com
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.17
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.75
  • 20.190.159.0
  • 40.126.31.73
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
UnityBase.DocNet dexInDocSetConsiderationStaffUnitID.msg